@camstack/system 1.2.378 → 1.2.380

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ar as isSecretMarker, B as StorageLocationModeSchema, Bt as isLocationEnabled, D as LegacyStorageLocationDefaultSchema, Dt as evictionPolicyOfLocation, Fn as storageMigrationCapability, Gr as EventCategory, H as StorageMigrationJobSchema, Kn as withLocationMode, Nr as parseJsonObject, Pn as storageCapability, Pt as gbToBytes, Rr as resolveSecretMarkers, V as StorageLocationTypeSchema, Vr as secretTreeFromPaths, Wr as transformSecretWrite, an as modeMayWrite, br as collectSecretConfigKeys, jn as settingsStoreCapability, lr as BaseAddon, nn as mayWriteToLocation, pr as REDACTED_SECRET, qt as legacyModeOf, tn as mayReadLocation, wn as resolveLocationMode, z as StorageCleanupJobSchema } from "../../dist-Bvl5JgNt.mjs";
+import { B as StorageLocationModeSchema, Bt as isLocationEnabled, D as LegacyStorageLocationDefaultSchema, Dt as evictionPolicyOfLocation, Fn as storageMigrationCapability, H as StorageMigrationJobSchema, Hr as secretTreeFromPaths, Kn as withLocationMode, Kr as transformSecretWrite, Pn as storageCapability, Pr as parseJsonObject, Pt as gbToBytes, V as StorageLocationTypeSchema, an as modeMayWrite, jn as settingsStoreCapability, jr as isSecretMarker, lr as BaseAddon, nn as mayWriteToLocation, pr as REDACTED_SECRET, qr as EventCategory, qt as legacyModeOf, tn as mayReadLocation, wn as resolveLocationMode, xr as collectSecretConfigKeys, z as StorageCleanupJobSchema, zr as resolveSecretMarkers } from "../../dist-B9oFw2jh.mjs";
 import { t as HUB_CAP_FWD_ACTION } from "../../hub-cap-forward-CH6_VWVO.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/system-config/cluster-secret-keeper.d.ts

@@ -0,0 +1,36 @@
+import { SecretsAccess } from '@camstack/types';
+/** The field key inside the `cluster` section. */
+export declare const CLUSTER_SECRET_FIELD = "clusterSecret";
+export declare const CLUSTER_SECRET_RETRY_MS = 30000;
+interface KeeperLogger {
+    info(message: string, meta?: {
+        meta?: Record<string, unknown>;
+    }): void;
+    error(message: string, meta?: {
+        meta?: Record<string, unknown>;
+    }): void;
+}
+export interface ClusterSecretKeeperDeps {
+    /** Keychain handle for owner `system`; `null` without a keychain door. */
+    readonly secrets: SecretsAccess | null;
+    /** The stored `cluster` section (markers, never values). Throws when unreadable. */
+    readonly readSection: () => Promise<Record<string, unknown>>;
+    readonly logger: KeeperLogger;
+    readonly retryMs?: number;
+}
+export declare class ClusterSecretKeeper {
+    private readonly deps;
+    private retryTimer;
+    private unsubscribe;
+    private stopped;
+    private last;
+    constructor(deps: ClusterSecretKeeperDeps);
+    start(): Promise<void>;
+    stop(): void;
+    /** Re-read the row and the keychain; publish the gate. */
+    reload(): Promise<void>;
+    private compute;
+    private report;
+    private scheduleRetry;
+}
+export {};

package/dist/builtins/system-config/system-config.addon.d.ts

@@ -1,10 +1,23 @@
 import { ConfigUISchemaWithValues, BaseAddon } from '@camstack/types';
+/** The section id of the cluster form — System → Cluster renders only this one. */
+export declare const SYSTEM_CONFIG_CLUSTER_SECTION_ID = "system-config-cluster";
 export declare class SystemConfigAddon extends BaseAddon {
     readonly id = "system-config";
+    private clusterSecretKeeper;
     constructor();
     protected onInitialize(): Promise<void>;
+    protected onShutdown(): Promise<void>;
+    /** The keychain handle for owner `system`; `null` where there is no door. */
+    private systemSecrets;
     private buildGlobalSchema;
     getGlobalSettings(): Promise<ConfigUISchemaWithValues>;
     updateGlobalSettings(patch: Record<string, unknown>): Promise<void>;
+    /**
+     * The cluster secret's save path: the value goes to the keychain (owner
+     * `system`), the row gets the marker; `''` / a view keeps, `$secretClear`
+     * clears. A value the keychain cannot store is REFUSED — never written
+     * inline (D787, P5).
+     */
+    private writeClusterSection;
 }
 export default SystemConfigAddon;

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,129 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-KxsOMQik.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_cluster_secret = require("../../cluster-secret-Dg0OOOSr.js");
+//#region src/builtins/system-config/cluster-secret-keeper.ts
+/**
+* Keeps the hub's cluster-secret gate in step with System → Cluster (D797).
+*
+* The field is a `password` of `system-config`: its `system-settings` row
+* (`cluster.clusterSecret`) holds a keychain marker, the value lives in the
+* keychain (owner `system`). The gate the `$hub.registerNode` handler reads:
+*
+*  - no marker            → `off` — every node may register, exactly as a hub
+*                           that never had a secret;
+*  - marker + value       → `on`  — nodes present the matching hash;
+*  - marker, no answer    → `unknown` — refused, retryably, and retried here.
+*    A locked keychain or a value lost to a reset NEVER opens the gate.
+*/
+/** The field key inside the `cluster` section. */
+var CLUSTER_SECRET_FIELD = "clusterSecret";
+var ClusterSecretKeeper = class {
+	deps;
+	retryTimer = null;
+	unsubscribe = null;
+	stopped = false;
+	last = null;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	async start() {
+		this.unsubscribe = this.deps.secrets?.onChange((ref) => {
+			if (ref === require_cluster_secret.CLUSTER_SECRET_REF) this.reload();
+		}) ?? null;
+		await this.reload();
+	}
+	stop() {
+		this.stopped = true;
+		if (this.retryTimer !== null) clearTimeout(this.retryTimer);
+		this.retryTimer = null;
+		this.unsubscribe?.();
+		this.unsubscribe = null;
+	}
+	/** Re-read the row and the keychain; publish the gate. */
+	async reload() {
+		if (this.stopped) return;
+		const gate = await this.compute();
+		if (this.stopped) return;
+		require_cluster_secret.setProcessClusterSecretGate(gate);
+		this.report(gate);
+		if (gate.kind === "unknown") this.scheduleRetry();
+	}
+	async compute() {
+		let stored;
+		try {
+			stored = (await this.deps.readSection())[CLUSTER_SECRET_FIELD];
+		} catch (err) {
+			return {
+				kind: "unknown",
+				reason: `settings unreadable: ${errText(err)}`
+			};
+		}
+		if (stored === void 0 || stored === null || stored === "") return { kind: "off" };
+		if (!require_dist.isSecretMarker(stored)) return {
+			kind: "unknown",
+			reason: "stored inline, not in the keychain — set it again in System → Cluster"
+		};
+		const secrets = this.deps.secrets;
+		if (secrets === null) return {
+			kind: "unknown",
+			reason: "no keychain door in this process"
+		};
+		let entry;
+		try {
+			entry = (await secrets.resolve([require_cluster_secret.CLUSTER_SECRET_REF]))[require_cluster_secret.CLUSTER_SECRET_REF];
+		} catch (err) {
+			return {
+				kind: "unknown",
+				reason: errText(err)
+			};
+		}
+		if (entry === void 0) return {
+			kind: "unknown",
+			reason: "no-answer"
+		};
+		switch (entry.kind) {
+			case "value": return {
+				kind: "on",
+				hash: require_cluster_secret.hashClusterSecret(entry.value)
+			};
+			case "unavailable": return {
+				kind: "unknown",
+				reason: entry.reason
+			};
+			case "missing": return {
+				kind: "unknown",
+				reason: "the stored value is gone — set it again in System → Cluster"
+			};
+			case "forbidden": return {
+				kind: "unknown",
+				reason: "forbidden"
+			};
+		}
+	}
+	report(gate) {
+		const changed = this.last !== gate.kind;
+		this.last = gate.kind;
+		if (gate.kind === "unknown") {
+			this.deps.logger.error("Agents cannot register: a cluster secret is set but cannot be read from the keychain. Registrations are refused until it can (no fallback).", { meta: { reason: gate.reason } });
+			return;
+		}
+		if (changed) this.deps.logger.info(gate.kind === "on" ? "Cluster secret set — agents must present it to register" : "No cluster secret set — any node may register");
+	}
+	scheduleRetry() {
+		if (this.stopped || this.retryTimer !== null) return;
+		this.retryTimer = setTimeout(() => {
+			this.retryTimer = null;
+			this.reload();
+		}, this.deps.retryMs ?? 3e4);
+		this.retryTimer.unref?.();
+	}
+};
+function errText(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+//#endregion
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.
@@ -17,6 +139,9 @@ const require_dist = require("../../dist-KxsOMQik.js");
 * Sections exposed — this list is the whole of it:
 *   - server     (port, host, dataPath — READ-ONLY, loaded from config.yaml at bootstrap)
 *   - auth       (tokenExpiry)
+*   - cluster    (clusterSecret — a `password` field: the value goes to the
+*                 keychain, owner `system`; the row keeps a marker. Also drawn
+*                 on System → Cluster. D797)
 *
 * Sections NOT exposed (each owned by the addon that implements them):
 *   - logging    → `winston-logging` addon (level + retention)
@@ -45,75 +170,112 @@ const require_dist = require("../../dist-KxsOMQik.js");
 /** Section key → user-facing section title. */
 var SECTION_TITLES = {
 	server: "Server",
-	auth: "Authentication"
+	auth: "Authentication",
+	cluster: "Cluster"
 };
+/** The keychain owner of the hub's own secrets (D797). */
+var SYSTEM_SECRET_OWNER = "system";
 /** Keys that map 1:1 to a given yml section — used by `updateGlobalSettings`
 *  to figure out which section owns each key in the incoming patch. */
 var KEY_TO_SECTION = {
 	port: "server",
 	host: "server",
 	dataPath: "server",
-	tokenExpiry: "auth"
+	tokenExpiry: "auth",
+	[CLUSTER_SECRET_FIELD]: "cluster"
 };
+/** The section id of the cluster form — System → Cluster renders only this one. */
+var SYSTEM_CONFIG_CLUSTER_SECTION_ID = "system-config-cluster";
 var SystemConfigAddon = class extends require_dist.BaseAddon {
 	id = "system-config";
+	clusterSecretKeeper = null;
 	constructor() {
 		super({});
 	}
 	async onInitialize() {
+		this.clusterSecretKeeper = new ClusterSecretKeeper({
+			secrets: this.systemSecrets(),
+			readSection: async () => await this.ctx.settings?.getSection("cluster") ?? {},
+			logger: this.ctx.logger
+		});
+		await this.clusterSecretKeeper.start();
 		this.ctx.logger.info("Initialized — exposes yml-backed sections via getGlobalSettings");
 	}
+	async onShutdown() {
+		this.clusterSecretKeeper?.stop();
+		this.clusterSecretKeeper = null;
+	}
+	/** The keychain handle for owner `system`; `null` where there is no door. */
+	systemSecrets() {
+		const forOwner = this.ctx.secrets?.forOwner ?? null;
+		return forOwner === null ? null : forOwner(SYSTEM_SECRET_OWNER);
+	}
 	buildGlobalSchema() {
-		return { sections: [{
-			id: "system-config-server",
-			title: SECTION_TITLES["server"],
-			description: "Core server connection settings — read-only, loaded from config.yaml at bootstrap.",
-			columns: 2,
-			fields: [
-				{
-					type: "info",
-					key: "server-restart-note",
-					label: "Restart required",
-					content: "Server settings are read-only. Change them in config.yaml and restart.",
-					variant: "warning"
-				},
-				{
+		return { sections: [
+			{
+				id: "system-config-server",
+				title: SECTION_TITLES["server"],
+				description: "Core server connection settings — read-only, loaded from config.yaml at bootstrap.",
+				columns: 2,
+				fields: [
+					{
+						type: "info",
+						key: "server-restart-note",
+						label: "Restart required",
+						content: "Server settings are read-only. Change them in config.yaml and restart.",
+						variant: "warning"
+					},
+					{
+						type: "text",
+						key: "port",
+						label: "Port",
+						description: "Listening port",
+						disabled: true
+					},
+					{
+						type: "text",
+						key: "host",
+						label: "Host",
+						description: "Bind address",
+						disabled: true
+					},
+					{
+						type: "text",
+						key: "dataPath",
+						label: "Data Path",
+						description: "Root data directory",
+						disabled: true,
+						span: 2
+					}
+				]
+			},
+			{
+				id: "system-config-auth",
+				title: SECTION_TITLES["auth"],
+				description: "Token and session settings.",
+				columns: 1,
+				fields: [{
 					type: "text",
-					key: "port",
-					label: "Port",
-					description: "Listening port",
-					disabled: true
-				},
-				{
-					type: "text",
-					key: "host",
-					label: "Host",
-					description: "Bind address",
-					disabled: true
-				},
-				{
-					type: "text",
-					key: "dataPath",
-					label: "Data Path",
-					description: "Root data directory",
-					disabled: true,
-					span: 2
-				}
-			]
-		}, {
-			id: "system-config-auth",
-			title: SECTION_TITLES["auth"],
-			description: "Token and session settings.",
-			columns: 1,
-			fields: [{
-				type: "text",
-				key: "tokenExpiry",
-				label: "Token Expiry",
-				description: "Lifetime of a session token, as a duration string (e.g. 24h, 7d, 30d). A bare number is rejected — it would be read as milliseconds. Applies to tokens issued from the next login or silent refresh; tokens already handed out keep the lifetime they were signed with.",
-				placeholder: "30d",
-				default: "30d"
-			}]
-		}] };
+					key: "tokenExpiry",
+					label: "Token Expiry",
+					description: "Lifetime of a session token, as a duration string (e.g. 24h, 7d, 30d). A bare number is rejected — it would be read as milliseconds. Applies to tokens issued from the next login or silent refresh; tokens already handed out keep the lifetime they were signed with.",
+					placeholder: "30d",
+					default: "30d"
+				}]
+			},
+			{
+				id: SYSTEM_CONFIG_CLUSTER_SECTION_ID,
+				title: SECTION_TITLES["cluster"],
+				description: "Agents joining this hub. Optional: with no cluster secret, any node that reaches the hub may register.",
+				columns: 1,
+				fields: [{
+					type: "password",
+					key: CLUSTER_SECRET_FIELD,
+					label: "Cluster secret",
+					description: "When set, an agent must present it to register. Stored in the keychain. To pair an agent: Reveal and copy it here, then enter it in the agent at first run (its status page or the desktop setup window). Changing it disconnects agents that still hold the old one at their next registration."
+				}]
+			}
+		] };
 	}
 	async getGlobalSettings() {
 		const schema = this.buildGlobalSchema();
@@ -130,7 +292,7 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 			} });
 			throw err;
 		}
-		return require_dist.hydrateSchema(schema, merged);
+		return require_dist.hydrateSchema(schema, merged, { inlineSecretsAsViews: true });
 	}
 	async updateGlobalSettings(patch) {
 		if (!this.ctx.settings) throw new Error("system-config: ctx.settings not available — cannot write sections");
@@ -153,6 +315,10 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 			bucket[key] = value;
 		}
 		for (const [section, sectionPatch] of perSection) {
+			if (section === "cluster") {
+				await this.writeClusterSection(sectionPatch);
+				continue;
+			}
 			await this.ctx.settings.setSection(section, sectionPatch);
 			this.ctx.logger.info("Wrote keys to section", { meta: {
 				section,
@@ -160,7 +326,32 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 			} });
 		}
 	}
+	/**
+	* The cluster secret's save path: the value goes to the keychain (owner
+	* `system`), the row gets the marker; `''` / a view keeps, `$secretClear`
+	* clears. A value the keychain cannot store is REFUSED — never written
+	* inline (D787, P5).
+	*/
+	async writeClusterSection(patch) {
+		const settings = this.ctx.settings;
+		const secrets = this.systemSecrets();
+		if (secrets === null) throw new Error("system-config: no keychain door — the cluster secret cannot be stored");
+		const stored = await settings.getSection("cluster");
+		const result = await require_dist.transformSecretWrite({
+			tree: require_dist.secretTreeFromSchema(this.buildGlobalSchema()),
+			secrets,
+			patch,
+			stored,
+			operatorWrite: true
+		});
+		if (Object.keys(result.patch).length > 0) await settings.setSection("cluster", result.patch);
+		const { orphaned } = await result.afterWrite();
+		if (orphaned.length > 0) this.ctx.logger.warn("cluster secret cleared, but its old keychain value could not be deleted", { meta: { refs: orphaned } });
+		this.ctx.logger.info("Cluster secret updated");
+		await this.clusterSecretKeeper?.reload();
+	}
 };
 //#endregion
+exports.SYSTEM_CONFIG_CLUSTER_SECTION_ID = SYSTEM_CONFIG_CLUSTER_SECTION_ID;
 exports.SystemConfigAddon = SystemConfigAddon;
 exports.default = SystemConfigAddon;